[java-identity-provider] 01/01: IDP-1601 - Hashed IdP Session ID audit log token
Scott Cantor
cantor.2 at osu.edu
Mon Jun 1 22:55:52 UTC 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch dev/IDP-1601
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=e5a2da32c91f6249617204bd254764e58881cb1f
commit e5a2da32c91f6249617204bd254764e58881cb1f
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Jun 1 18:55:22 2020 -0400
IDP-1601 - Hashed IdP Session ID audit log token
https://issues.shibboleth.net/jira/browse/IDP-1601
---
idp-conf/src/main/resources/conf/audit.xml | 2 +-
.../main/resources/system/conf/audit-system.xml | 59 +++++++++++++++++++++-
.../net/shibboleth/idp/profile/IdPAuditFields.java | 3 ++
3 files changed, 61 insertions(+), 3 deletions(-)
diff --git a/idp-conf/src/main/resources/conf/audit.xml b/idp-conf/src/main/resources/conf/audit.xml
index a9faf4c9e..45255853a 100644
--- a/idp-conf/src/main/resources/conf/audit.xml
+++ b/idp-conf/src/main/resources/conf/audit.xml
@@ -14,7 +14,7 @@
This bean defines a mapping between audit log categories and formatting strings.
-->
<util:map id="shibboleth.AuditFormattingMap">
- <entry key="Shibboleth-Audit" value="%a|%ST|%T|%u|%SP|%i|%ac|%t|%attr|%n|%f|%SSO|%XX|%XA|%b|%bb|%e|%S|%SS|%s|%UA" />
+ <entry key="Shibboleth-Audit" value="%a|%ST|%T|%HASHEDu|%SP|%i|%ac|%t|%attr|%n|%f|%SSO|%XX|%XA|%b|%bb|%e|%S|%SS|%HASHEDs|%UA" />
</util:map>
<!-- Override the format of date/time fields in the log and/or convert to default time zone. -->
diff --git a/idp-conf/src/main/resources/system/conf/audit-system.xml b/idp-conf/src/main/resources/system/conf/audit-system.xml
index ac2715cfa..ebc45155a 100644
--- a/idp-conf/src/main/resources/system/conf/audit-system.xml
+++ b/idp-conf/src/main/resources/system/conf/audit-system.xml
@@ -40,8 +40,8 @@
<bean id="shibboleth.UsernameHasher" parent="shibboleth.Functions.Compose">
<constructor-arg name="g">
<bean class="net.shibboleth.utilities.java.support.codec.StringDigester"
- c:algorithm="#{'%{idp.fticks.algorithm:SHA-256}'.trim()}" c:format="HEX_LOWER"
- p:salt="%{idp.fticks.salt:}" p:requireSalt="true" />
+ c:algorithm="#{'%{idp.fticks.algorithm:%{idp.audit.hashAlgorithm:SHA-256}}'.trim()}" c:format="HEX_LOWER"
+ p:salt="%{idp.fticks.salt:%{idp.audit.salt:}}" p:requireSalt="true" />
</constructor-arg>
<constructor-arg name="f">
<bean parent="shibboleth.Functions.Compose">
@@ -55,6 +55,25 @@
</constructor-arg>
</bean>
+ <!-- Reusable bean for extracting a session id and hashing it. -->
+ <bean id="shibboleth.SessionIDHasher" parent="shibboleth.Functions.Compose">
+ <constructor-arg name="g">
+ <bean class="net.shibboleth.utilities.java.support.codec.StringDigester"
+ c:algorithm="#{'%{idp.fticks.algorithm:%{idp.audit.hashAlgorithm:SHA-256}}'.trim()}" c:format="HEX_LOWER"
+ p:salt="%{idp.fticks.salt:%{idp.audit.salt:}}" p:requireSalt="true" />
+ </constructor-arg>
+ <constructor-arg name="f">
+ <bean parent="shibboleth.Functions.Compose">
+ <constructor-arg name="g">
+ <bean class="net.shibboleth.idp.session.context.navigate.SessionContextIDLookupFunction" />
+ </constructor-arg>
+ <constructor-arg name="f">
+ <ref bean="shibboleth.ChildLookup.SessionContext" />
+ </constructor-arg>
+ </bean>
+ </constructor-arg>
+ </bean>
+
<bean id="shibboleth.ProtocolLookupFunction" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript">
<constructor-arg>
<value>
@@ -775,6 +794,12 @@
</constructor-arg>
</bean>
</entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.profile.IdPAuditFields.HASHED_SESSION_ID"/>
+ </key>
+ <ref bean="shibboleth.SessionIDHasher" />
+ </entry>
<entry>
<key>
<util:constant static-field="net.shibboleth.idp.profile.IdPAuditFields.ATTRIBUTES"/>
@@ -1077,6 +1102,12 @@
</constructor-arg>
</bean>
</entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.profile.IdPAuditFields.HASHED_SESSION_ID"/>
+ </key>
+ <ref bean="shibboleth.SessionIDHasher" />
+ </entry>
</map>
</property>
</bean>
@@ -1112,6 +1143,12 @@
</constructor-arg>
</bean>
</entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.profile.IdPAuditFields.HASHED_SESSION_ID"/>
+ </key>
+ <ref bean="shibboleth.SessionIDHasher" />
+ </entry>
<entry>
<key>
<util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.NAMEID"/>
@@ -1202,6 +1239,12 @@
</constructor-arg>
</bean>
</entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.profile.IdPAuditFields.HASHED_SESSION_ID"/>
+ </key>
+ <ref bean="shibboleth.SessionIDHasher" />
+ </entry>
</map>
</property>
</bean>
@@ -1288,6 +1331,12 @@
</constructor-arg>
</bean>
</entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.profile.IdPAuditFields.HASHED_SESSION_ID"/>
+ </key>
+ <ref bean="shibboleth.SessionIDHasher" />
+ </entry>
<entry>
<key>
<util:constant static-field="net.shibboleth.idp.cas.protocol.CASAuditFields.SERVICE_TICKET"/>
@@ -1343,6 +1392,12 @@
</constructor-arg>
</bean>
</entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.profile.IdPAuditFields.HASHED_SESSION_ID"/>
+ </key>
+ <ref bean="shibboleth.SessionIDHasher" />
+ </entry>
<entry>
<key>
<util:constant static-field="net.shibboleth.idp.cas.protocol.CASAuditFields.SERVICE_TICKET"/>
diff --git a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/IdPAuditFields.java b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/IdPAuditFields.java
index 0a960fc60..944c3271e 100644
--- a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/IdPAuditFields.java
+++ b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/IdPAuditFields.java
@@ -47,6 +47,9 @@ public final class IdPAuditFields {
/** Session ID field. */
@Nonnull @NotEmpty public static final String SESSION_ID = "s";
+ /** Hashed session ID field. */
+ @Nonnull @NotEmpty public static final String HASHED_SESSION_ID = "HASHEDs";
+
/** Remote address field. */
@Nonnull @NotEmpty public static final String REMOTE_ADDR = "a";
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list